rowanu / boc-effective Goto Github PK

Introduction blog post, docs

• Blog post
• Twitter
• r/aws

Use Bulma's textarea class is-warning.

Basic styling and layout. No mobile support.

Use Bulma?

Notify of any build/deploy failures.

Announcement, user guide.

Update expanded policies to respect NotAction in IAM policies

CodeCommit > GitHub integration for the lolz

They aren't used.

This policy results in a report that includes ``, but it has no actions:

{
  "Statement": [
    {
      "Action": [
        "logs:*"
      ],
      "Effect": "Allow",
      "Resource": "arn:aws:logs:*:*:*"
    },
    {
      "Action": [
        "logs:*"
      ],
      "Effect": "Deny",
      "Resource": "arn:aws:logs:*:*:*"
    },
    {
      "Action": [
        "s3:GetObject",
        "s3:PutObject"
      ],
      "Effect": "Allow",
      "Resource": "arn:aws:s3:::*"
    }
  ],
  "Version": "2012-10-17"
}```

There's interest.

Will create a milestone to track.

error.dataPath returned by ajv include a leading "." (which is right).

Currently, that's being jammed in the response that's displayed to the user, for example:

.Statement should NOT have fewer than 1 items

Maybe don't do that.

So that user doesn't need to download >200KB before seeing the website.

It should be easy to do the fetch; the biggest issue will be how this impacts testing, and how should the actions should be simulated in testing - should it just be loaded from local copy of policies.js?

Raised via email.

Given the policy:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "s3:*AccessPoint"
      ],
      "Resource": "*"
    }
  ]
}

Current Output:

Policy allows 8 actions on *

s3:CreateAccessPoint
s3:DeleteAccessPoint
s3:DeleteAccessPointPolicy
s3:GetAccessPoint
s3:GetAccessPointPolicy
s3:GetAccessPointPolicyStatus
s3:ListAccessPoints
s3:PutAccessPointPolicy

Expected Output:

Policy allows 3 actions on *

s3:CreateAccessPoint
s3:DeleteAccessPoint
s3:GetAccessPoint

Merge all actions (per resource?) and match against the full list of actions https://awspolicygen.s3.amazonaws.com/js/policies.js

Relevant IAM docs.

See the docs.

Convert policy to something (base64?) that is embeddable in query string parameters.

Add stage post-S3 deployment.

invalidate-cache:
	aws cloudfront create-invalidation \
                --distribution-id XXX \
		--paths '/*

Not be an empty string.

• Site
• Pipeline
• Distribution
• Origin for bucket
• DNS record: effective.bigorange.cloud

It blocked 🙃

From the console:

Fetching https://awspolicygen.s3.amazonaws.com/js/policies.js
boc-effective-site-bucket-cl1zushj3npr.s3-website-us-east-1.amazonaws.com/:1 Access to fetch at 'https://awspolicygen.s3.amazonaws.com/js/policies.js' from origin 'http://boc-effective-site-bucket-cl1zushj3npr.s3-website-us-east-1.amazonaws.com' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource. If an opaque response serves your needs, set the request's mode to 'no-cors' to fetch the resource with CORS disabled.

And this is why you deploy ASAP 🙏

http://analytics.google.com/analytics/web/

Stop showing stale report.

As requested in AWS Developer Slack

This would be hard, as it would require requests to AWS with authorization, and the application is just a client-side application (on a different domain).

Fail on invalid versions.

Warn when not "2012-10-17"

Currently actions are stored in src/actions.json and updated via fetch.js.

Update in pipeline? Scheduled? See boc-jobs for an example.

Create a pipeline that does CI/CD for the website.

There's a solution, but it requires Lambda@Edge.

Install required dependencies as part of make install: cfn-lint, yamllint, etc

Just git hash is fine.

See this example in the Vue CLI docs.

Show report, hide instructions.

e.g. "Resource": "*"

Allow and Deny

This policy should ALLOW all actions:

{
    "Version": "2012-10-17",
    "Statement": [{
        "Sid": "DenyAllUsersNotUsingMFA",
        "Effect": "Deny",
        "NotAction": "iam:*",
        "Resource": "*",
        "Condition": {"BoolIfExists": {"aws:MultiFactorAuthPresent": "false"}}
    },{
        "Sid": "AllowIAM",
        "Effect": "Allow",
        "Action": "iam:*",
        "Resource": "*"
    }]
}

https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements.html

• Version
• Id
• Statement
• Sid
• Effect
• Principal
• NotPrincipal
• Action
• NotAction
• Resource
• NotResource
• Condition

Snapshot tests?

make test

From Security Slack:

Thanks for this @Rowan Udell !  If you do s3:G* does it work for you?  I’m getting items that don’t match that and I want to make sure I’m not doing something unexpected

Identity-based policies

Sample policies https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_examples.html

Try the following policy to see the full list of AWS acionts - it's the AWS Administrator Access Managed Policy arn:aws:iam::aws:policy/AdministratorAccess:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": "*",
            "Resource": "*"
        }
    ]
}

Something a little more real-world:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": "s3:get*",
            "Resource": "*"
        }
    ]
}

For example:

"Policy {allows/does not} allow {COUNT} actions against resource {RESOURCE}"

Here's an example implementation.